Highly Critical Hole Found in IE

dotpavan writes "Eweek reports on a highly critical MS Internet Explorer hole found by Secunia Research's Andreas Sandblad. The vulnerability is due to the processing of the "createTextRange()" method call applied on a radio button control. From Secunia, "The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2." The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (January edition) though it could be avoided by turning off Active Scripting, as suggested by Microsoft Security Response Center blog. How would this put MS in the market, hit by the ever-growing shots of vulnerabilties? And would the divorce of IE7 from Vista's Windows Explorer help?"

Patch available

[thrillseeker]

here [mozilla.com]

GAH

[Anonymous Coward]

Please don't post stories like this until a patch or fix has been released! I always get paranoid after reading a story about another IE hole. If you wait until the fix is released, I'll have a blissful few days.

Highly Critical Hole Found in IE?

[Anonymous Coward]

Must be thursday.

Perhaps it would save time...

[Threni]

...if researchers just identified the bits that *weren't* totally insecure?

It is not a dupe!

[Life700MB]

It's a brand new hole!


--
Superb hosting [tinyurl.com] 20GB Storage, 1_TB_ bandwidth, ssh, $7.95

Hole?

[jav1231]

Is it shaped like a woman's mouth? I mean, that's a highly critical hole.

Do what now?

[Rob T Firefly]

TFA: Microsoft plans to release a pre-patch advisory with workarounds for a "highly critical" vulnerability that could put millions of Internet Explorer users at the mercy of malicious hackers

So this article updates us to the fact that they plan to update us with an article prior to the update?

Re:Patch available

[babbling]

That won't fix the problem completely. To complete the fix, iexplore.exe should be replaced with a program that runs firefox.exe instead.

Could be worst...

[__aaclcg7560]

It could've been a very cynical hole in IE concerning when Windows Vista will finally be released.

Proof of concept

[Anonymous Coward]

<input type="radio" action="crash">

Someone translate this for me:

[brouski]

How would this put MS in the market, hit by the ever-growing shots of vulnerabilties?

Come again?

got it backwards

[gurutc]

IE is the hole, into which are placed 'features' such as this exploit, tied to the feature called 'activex.' Remove these 'features' and all that is left is the nothingness that is a hole.

Use it for good not evil

[slashbob22]

createText("install firefox.exe");
createTextRange(-1);

And just let the exploit install firefox. It's just that easy.

mirror

[eclectro]

here. [opera.com]

IE user, your house is on fire. Run for the hills! Go! Go!

divorce

[Tachikoma]

And would the divorce of IE7 from Vista's Windows Explorer help?
maybe, but i still recommend divorcing windows entirely. i've loved computers before (not sexually ... you perverts!) but not until my power book did one love me back...

Dupe!

[p0]

Dupe!

Re:Perhaps it would save time...

[Anonymous Coward]

...if researchers just identified the bits that *weren't* totally insecure?

Come on, the RFC on this [faqs.org] is several years old!

Damn networking hardware monopoly is hampering progress!

I am...

[PFI_Optix]

...Jack's complete lack of surprise.

Re:Highly Critical Hole Found in IE?

[lowe0]

I could never quite get the hang of Thursdays.

Re:It's funny

[Anonymous Coward]

A DDoS isn't a vulnerability any more than someone throwing a brick at your face.

Safest browser ever available

[Otis2222222]

Here. [isc.org] Guaranteed not to be exploited by any javascript or plugin vulnerability. Or by any site that uses frames.

The 1st IE7 worm after the 'divorce' from windows

[rubberbando]

shall be named "alimony"!

Re:Proof of concept

[SB_SamuraiSam]

That's why it works on IE.

Re:IE 7 in Vista would have been safe

[Tumbleweed]

This just goes to show that if you give MS enough time, they'll eventually be able to reinvent UNIX-like security. That's a relief.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Highly Critical

[gnovos]

This hole will complain endlessly about your banal surfing habits and tell you taht are beginning to look a little fat. It's amazingly critical.

Re:Patch available

[Anonymous Coward]

I found out that the directory explorer actually IS explorer and that Outlook requires IE as well or it just won't work.

They could have removed IE a long time ago but just decided NOT to.

1995 called; they want their news back.

Re:Safest browser ever available

[phantomfive]

Lynx only seems safe because it has such a small marketshare. As soon as more people use it, hackers will target it more. You will see.

misplaced trust

[Scrameustache]

add *.windowsupdate.com and *.microsoft.com to your trusted sites.

You gullible, gullible fool : )

Re:Patch available

[dusik]

>> "Outlook requires IE as well or it just won't work."

That's because you're not done until you replace Outlook with Thunderbird ;)